Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    ver2_0_file.rar
  • Size 10.5MB
  • SHA256 3b584d1857aa692940626f45876717884474786b582092b1165a6d69058a91fe
  • MD5 5d1efb087e3e761b0f0ab9b8f0cf83b0
  • SHA1 7905ef35686d233736802950ed1185d70b0d0275
  • SHA512 e93f64755c1cbdbb41e948e8162e28dd2a8ae014992c47f3ed83bb14ff41eeb8f4f9773197115cc62c35d4f4b9d6a097fc65f77dec7c31ca638b921020df6f60
  • SSDEEP 196608:m487CfpQlFNJudSKUd63zHuM6mRQhehCEXlb9z3IVB6KrucJtRNiIejvmD3GA+tp:mR7Cofu/zOM6AlhV1b9cMeuStRNV7GAK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gcleanerriseprosmokeloaderstealcvidar473851422af56ec6b6c329e5cb4d622dpub3backdoorevasionloaderspywarestealerthemidatrojan

  • Detect Vidar Stealer

    stealer

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1